systemctl --now mask nftables